Overview

overview

10

Static

static

10

builder.exe

windows10-1703-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    builder.exe

  • Size

    19.8MB

  • Sample

    240623-q4ygzawgrq

  • MD5

    95419e62271175d0d3b3306b0befffb3

  • SHA1

    e5a126c4d582372385212d804658056651599d95

  • SHA256

    394a76cae20c6d644a5f9a12099b48ee2058f6b03ff3f83805bb5d078248cb8c

  • SHA512

    5d2de343eb27d2bc471f7368debe98665c07a3a1a79ab2e2b084312f807db07697aa3f3a79b1b683c54b364020f012f812a8018fecf08419011f6945da4771bf

  • SSDEEP

    393216:MQtstvdqJr7M5liAdQJlOwF3MnG3otl5cGaABo1edW3zCd1Z5Z:MQtstVA7M5lndQD3MGYNjbCOf

Score
10/10
crealstealerpyinstallerspywarestealer

Malware Config

Targets

    • Target

      builder.exe

    • Size

      19.8MB

    • MD5

      95419e62271175d0d3b3306b0befffb3

    • SHA1

      e5a126c4d582372385212d804658056651599d95

    • SHA256

      394a76cae20c6d644a5f9a12099b48ee2058f6b03ff3f83805bb5d078248cb8c

    • SHA512

      5d2de343eb27d2bc471f7368debe98665c07a3a1a79ab2e2b084312f807db07697aa3f3a79b1b683c54b364020f012f812a8018fecf08419011f6945da4771bf

    • SSDEEP

      393216:MQtstvdqJr7M5liAdQJlOwF3MnG3otl5cGaABo1edW3zCd1Z5Z:MQtstVA7M5lndQD3MGYNjbCOf

    Score
    7/10
    spywarestealer

    • Drops startup file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks